{"id":"CVE-2026-10277","summary":"j3k0 mcp-google-workspace MCP Gmail Tool gmail.ts saveToDisk access control","details":"A vulnerability was found in j3k0 mcp-google-workspace up to 831790e7d5c2663325733d9f5579cc339a267c4c. This issue affects the function saveToDisk of the file src/tools/gmail.ts of the component MCP Gmail Tool. Performing a manipulation results in improper access controls. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The patch is named 89c091ecf8b9f9c7291d1af0b1966e271f86551c. It is suggested to install a patch to address this issue.","modified":"2026-10-08T02:49:14.386391353Z","published":"2026-06-01T17:15:10.146Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-266","CWE-284"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10277.json"},"references":[{"type":"WEB","url":"https://github.com/j3k0/mcp-google-workspace/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10277.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10277"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-10277"},{"type":"ADVISORY","url":"https://vuldb.com/submit/825416"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/367570"},{"type":"REPORT","url":"https://github.com/j3k0/mcp-google-workspace/issues/19"},{"type":"REPORT","url":"https://vuldb.com/vuln/367570/cti"},{"type":"FIX","url":"https://github.com/j3k0/mcp-google-workspace/commit/89c091ecf8b9f9c7291d1af0b1966e271f86551c"},{"type":"FIX","url":"https://github.com/j3k0/mcp-google-workspace/pull/22"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/j3k0/mcp-google-workspace","events":[{"introduced":"831790e7d5c2663325733d9f5579cc339a267c4c"},{"last_affected":"831790e7d5c2663325733d9f5579cc339a267c4c"}]}],"versions":["831790e7d5c2663325733d9f5579cc339a267c4c"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10277.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}